---
id: CVE-2025-67013
title: >-
  The web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band
  Distribution System v1.8 does not implement Cross-Site Request Forgery (CSRF)
  protection mechanisms (no tokens, no Origin/Referer validation) on critical
  conf…
summary: >-
  The web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band
  Distribution System v1.8 does not implement Cross-Site Request Forgery (CSRF)
  protection mechanisms (no tokens, no Origin/Referer validation) on critical
  conf…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'
cwe:
  - CWE-352
vendor: etlsystems
product: d0116s1ula-22454_firmware
affected:
  - d0116s1ula-22454_firmware = 1.8
  - d0116s1uia-22474_firmware = 1.8
  - c0401s1ula-22418_firmware = 1.8
  - c0801s1ula-22420_firmware = 1.8
  - c1601s1ula-22422_firmware = 1.8
  - c0401s1ula-22455_firmware = 1.8
  - c0801s1ula-22457_firmware = 1.8
  - c1601s1ula-22459_firmware = 1.8
  - c1601s1uia-22479_firmware = 1.8
  - d0104d1ula-22411_firmware = 1.8
  - d0108d1ula-22413_firmware = 1.8
  - d0104d1ula-22451_firmware = 1.8
  - d0108d1ula-22453_firmware = 1.8
  - d0108d1uia-22473_firmware = 1.8
  - c0401d1ula-22419_firmware = 1.8
  - c0801d1ula-22421_firmware = 1.8
  - c0401d1ula-22456_firmware = 1.8
  - c0801d1ula-22458_firmware = 1.8
  - c0401d1uia-22476_firmware = 1.8
  - h0108d1ula-22431_firmware = 1.8
  - h0104d1ula-22460_firmware = 1.8
  - h0108d1ula-22461_firmware = 1.8
  - d0104s1ula-22410_firmware = 1.8
  - d0108s1ula-22412_firmware = 1.8
  - d0116s1ula-22414_firmware = 1.8
  - d0104s1ula-22450_firmware = 1.8
  - d0108s1ula-22452_firmware = 1.8
published: '2025-12-26'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T09:10:00.323'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-67013'
references:
  - url: >-
      https://github.com/shiky8/my--cve-vulnerability-research/tree/main/CVE-2025-67013%20_%20ETL%20Systems%20Ltd%20DEXTRA%20Series%20_%20CSRF
    label: cve@mitre.org
  - url: 'https://www.etlsystems.com/'
    label: cve@mitre.org
tags:
  - nvd
epss: 0.00168
epssPercentile: 0.05556
ingestedAt: '2026-10-13T09:20:23.156Z'
---

## Overview

The web management interface in ETL Systems Ltd DEXTRA Series ' Digital L-Band Distribution System v1.8 does not implement Cross-Site Request Forgery (CSRF) protection mechanisms (no tokens, no Origin/Referer validation) on critical configuration endpoints.

## Affected

- `d0116s1ula-22454_firmware = 1.8`
- `d0116s1uia-22474_firmware = 1.8`
- `c0401s1ula-22418_firmware = 1.8`
- `c0801s1ula-22420_firmware = 1.8`
- `c1601s1ula-22422_firmware = 1.8`
- `c0401s1ula-22455_firmware = 1.8`
- `c0801s1ula-22457_firmware = 1.8`
- `c1601s1ula-22459_firmware = 1.8`
- `c1601s1uia-22479_firmware = 1.8`
- `d0104d1ula-22411_firmware = 1.8`
- `d0108d1ula-22413_firmware = 1.8`
- `d0104d1ula-22451_firmware = 1.8`
- `d0108d1ula-22453_firmware = 1.8`
- `d0108d1uia-22473_firmware = 1.8`
- `c0401d1ula-22419_firmware = 1.8`
- `c0801d1ula-22421_firmware = 1.8`
- `c0401d1ula-22456_firmware = 1.8`
- `c0801d1ula-22458_firmware = 1.8`
- `c0401d1uia-22476_firmware = 1.8`
- `h0108d1ula-22431_firmware = 1.8`
- `h0104d1ula-22460_firmware = 1.8`
- `h0108d1ula-22461_firmware = 1.8`
- `d0104s1ula-22410_firmware = 1.8`
- `d0108s1ula-22412_firmware = 1.8`
- `d0116s1ula-22414_firmware = 1.8`
- `d0104s1ula-22450_firmware = 1.8`
- `d0108s1ula-22452_firmware = 1.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.